What will happen to an active UA session if the application certificate expired?

[charlesaugustineabb]

What will happen to an active UA session if the application certificate expired? 

assume there is an active UA session running for many years and the certificate expired while active session.

What will happen to this session?

[mregen]

At this time the certificate is only checked when the connection is renewed.

[pmills-beckman]

@mregen My apologies for bringing up an old thread, but I am working through a similar issue with the OPCUA server we've written.

We have a default 1-year self-signed certificate that is created (if not already present) when the server application starts up (via _applicationInstance.CheckApplicationInstanceCertificate(...)
As your answer stated: when the certificate expires, any currently-connected client is /fine/ as long as it remains connected. But when the client disconnects, or another client joins, their connection faults because the certificate has become invalid.

Is there a "clean" way to handle this without restarting the OPCUA server instance?

As luck would have it, the certificate never expires unless we happen to be running something crucial that requires active monitoring, so restarting the server to recreate the certificate is not simple. I'd prefer to be able to simply reset the application instance certificate "on the fly" (ideally before it expired) using a function similar to the (private) ApplicationInstance.CreateApplicationInstanceCertificateAsync(...) which helpfully deletes the existing certificate and creates the new one in one shot.

I've considered switching to generating (say) 10-year certificates, but it seems like that is just pushing the problem down the road instead of actually solving it for my application.

[romanett]

@pmills-beckman for this Usercase the Server Supports the OPC Ua Partt 12 GDS Push Spec. As an Admin you can call the Update-Certificate Method on the Server. This new cert can be applied without a restart. However all Sessions are disconnected in the process.

[pmills-beckman]

@romanett I'm working to do this all programatically from within our instance.
Is there an equivalent to Update-Certificate within the ApplicationInstance class?

[romanett]

Not really, but you could make all necesary changes from code:

1. Add new Application Certificates to Certificate Identifiers in Configuration.SecurityConfiguration.ApplicationCertificates
2. Call SecurityConfiguration.CertificateValidator.UpdateCertificateAsync
3. Verify ServerBase.OnCertificateUpdate is called to update the EndpointDescriptions & TransportListeners with the new ApplicationCertificates

[mregen]

Slight correction for my previous comment. The certificate is also checked if the security token is renewed, so with a default configuration of 3600s every hour there is a validation check. Then it depends if the validation error for expired certificates is suppressed.
To delete an application certificate(s), there is also a function

UA-.NETStandard/Libraries/Opc.Ua.Configuration/ApplicationInstance.cs

Line 435 in 7f037ef

public async Task DeleteApplicationInstanceCertificate(string[] profileIds = null, CancellationToken ct = default)